t-mobile[.]wjsip[.]cc

Analysis conducted on 23 July 2026 identifies the domain t-mobile.wjsip.cc as part of an elevated-risk generic phishing infrastructure. The domain was registered on 21 February 2026 and resolves to the IP address 104.21.41.64, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The hosting provider is therefore a widely used content-delivery network, a common choice for malicious actors seeking to hide origin. The domain’s SSL certificate is identified as WE1, indicating a publicly-trusted TLS certificate without further validation of the issuing authority.

VirusTotal scans show that 16 of 93 anti-malware engines flag the domain, demonstrating a moderate level of detection across the security ecosystem. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that at least one defensive platform has taken mitigation steps. Current HTTP probing indicates the domain is offline, which may be the result of takedown actions or a temporary suspension by the hosting service. While the available data confirms the phishing nature of the infrastructure, the specific content served, the phishing kit, and the target brand page title remain unverified because no live page was captured.

Consequently, definitive conclusions about the exact lure cannot be drawn. Defenders should update URL filtering and DNS block policies to include t-mobile.wjsip.cc, monitor for any re-appearance of the domain or associated IP address, and consider sharing the indicator with threat-sharing communities. Continuous re-scanning of the domain on VirusTotal and other sandbox environments is advisable in case the site is reinstated. Organizations that employ brand-monitoring solutions should flag any similar sub-domains that combine "t-mobile" with unrelated second-level domains, as this pattern has been observed in the current campaign.